How to handle an attendee request to delete their personal data

When an attendee asks you to delete their personal data, record the request, confirm who is asking, find their information across your systems and decide what you can erase. Check where the right to deletion applies and whether an exception requires or allows you to keep specific records. Delete what the rules require, explain any retained information and check that suppliers, exports and future marketing won't undo your work.

The awkward part isn't the delete button. It's the spreadsheet your door manager downloaded, the invoice your accountant needs and the mailing list someone plans to import before the next event. You need an answer for each of those places, without turning a straightforward request into an argument with a paying customer.

This guide walks you through a practical deletion request process for a paid event business. It uses UK GDPR as its main legal frame and identifies EU guidance where relevant. Other countries have different privacy rights and recordkeeping rules. Check the law that applies to your business and attendees before using the templates.

Start with what the attendee actually asked for

"Delete my information" is enough to get your attention. The person doesn't need to know the phrase "right to erasure", quote legislation or find a special form. An email to customer support, a message to your event account or a conversation at the door can all contain a request your team needs to recognise.

Read the whole message before deciding what action belongs on the task. Someone might want to stop promotional emails, close an account, remove a dietary requirement, delete every record you hold or remove a photograph from your website. Those requests overlap, but they don't all have the same answer.

Your first job is to capture their words accurately. If they made the request verbally, write down the date, contact details, what they said and who received it. Ask them to confirm your understanding where necessary. Don't make them start again because they spoke to the wrong team member.

Suppose an attendee writes, "Please delete my details. I don't want any more offers about your events." Stop the marketing covered by that objection and assess the wider deletion request. Don't quietly treat it as an unsubscribe and declare the whole job finished. Equally, don't wipe an unpaid refund record before you've considered why you still need it.

Keep the request away from your general production chat. A short task reference is enough for most colleagues. The full message and any sensitive information belong somewhere with appropriate access controls. Passing a request around without limits can create more copies of the very information you're trying to remove.

Record the deadline before you begin searching

The ICO's right to erasure guidance says to respond without undue delay and at the latest within one calendar month. Its current guidance allows a further two months for a complex request or multiple requests from the individual, with the reason communicated within the first month. An extension needs a real justification.

Put the received date, response deadline, owner and next action in your request log. Calculate the deadline carefully instead of assuming a month means thirty days. Build an earlier internal target into your process so a missing supplier response doesn't leave you writing the final answer at the last minute.

The ICO currently explains that the response period starts when you receive the request or, if later, necessary information requested to confirm identity. Ask promptly and proportionately when you have genuine doubts. Don't use routine identity checks to create delay. The ICO marks this guidance as under review following the Data (Use and Access) Act, so recheck it when handling a request.

A useful acknowledgement names the request and tells the person what happens next. It doesn't promise that every record will vanish before anyone has investigated. You can say that you're reviewing their request, have assigned an owner and will explain the outcome by the applicable deadline.

Here is an acknowledgement you can adapt:

"Thanks for getting in touch. We've recorded your request to delete your personal information, received on [date]. [Team or contact] is handling it. We'll review the information we hold and explain what we've deleted and whether any records must be retained by [deadline]. We've also stopped the promotional messages you asked us to stop."

Use that last sentence only after you've done it. If you need identity information, explain what you need and how to provide it securely. Don't attach an empty promise to a process you haven't started.

Confirm identity without collecting a new problem

You need enough confidence that you're acting on the right person's request. Deleting an attendee's booking because someone else guessed their name is a poor outcome. Asking every customer for a passport creates its own unnecessary collection of information.

Start with what you already know. Is the person writing from the address associated with their booking? Are they signed into an authenticated account? Can you use a safe verification step through the existing contact channel? The appropriate check depends on the information involved and the risk of getting it wrong.

If the request comes from a different address, ask for the minimum useful detail. An order reference and the email used to book might help you locate the record, but decide whether that combination proves identity or merely finds a booking. Don't confuse a searchable detail with a secure check.

Group bookings need extra care. The ticket purchaser and the named attendees may be different people. A buyer asking to remove their marketing details doesn't automatically give you permission to delete every attendee's separate profile. A delegate asking to erase their personal information doesn't automatically cancel the purchaser's entire order either.

If a representative contacts you, establish their authority to act for the individual. Keep the check focused on the request. Don't send them another person's booking history before you've confirmed that they're entitled to receive it.

Requests involving children, accessibility needs, health details or a dispute deserve attention from the person responsible for privacy decisions. They may involve sensitive information or a higher consequence if you act on the wrong record. Escalating a specific risk is useful; making every request wait for a committee isn't.

Write down how you confirmed identity, without keeping unnecessary copies of identity documents. If you did collect a document, decide how securely it is handled and when it will be removed. Your verification process shouldn't become a permanent archive of passports for people who wanted less information held about them.

Find the information across the event business

The first step is to follow the attendee's information through their booking. Where did it enter your business, where did it travel and who still has a copy? Start there, then check any later communications or separate forms.

Search by the verified identifiers you hold. Depending on your systems, that could include email address, customer reference, order number or attendee identifier. Names alone can produce the wrong match, particularly when your event has repeat buyers or several attendees with the same name.

Your search should cover more than the ticket record. Think about registration answers, customer support messages, mailing lists, surveys, badge files, check-in exports, seating notes and shared folders. Check public attendee directories and event apps if you use them. Review advertising audiences containing uploaded customer records where relevant.

Follow the exports. A supplier may have received a dietary list, a venue may have an access list and a contractor may have downloaded the door sheet. Your central database won't tell you whether a spreadsheet remains on someone's laptop unless your process already records those handoffs.

Build a working list with one row per location. Record what is there, who controls it, why it exists and the action required. Add an owner and a verification field. Keep that list accessible to the people doing the work without exposing the attendee's information to everyone in the business.

Check old event editions too. A recurring conference can leave the same person in several years of files. A nightclub series can accumulate separate door lists and promotional audiences. Search the systems you actually use, rather than treating the most recent ticket as the full history.

Decide what to erase and what to retain

You don't have to choose between deleting everything and refusing everything. A request can have several outcomes because different records serve different purposes. The decision should happen at the level of the information and its use, rather than at the level of "this person bought a ticket".

The EU's GDPR text on EUR-Lex sets out erasure grounds in Article 17 and exceptions including necessary processing for legal obligations and legal claims. The UK has its own GDPR regime. For your operational decision, identify the applicable ground and any relevant exception, then document why each retained record remains necessary.

The ICO lists grounds including information you no longer need, unlawful processing and a legal obligation to erase it. Withdrawal of consent is a ground where you relied on that consent. An objection to direct marketing also triggers erasure for that use. For processing based on legitimate interests, assess whether overriding grounds remain after an objection. There is also a specific ground for information collected when offering online services to a child. Having a lawful basis on file doesn't settle the request; assess the applicable erasure ground and any genuine retention exception.

A past-event dietary note may no longer have a purpose. An invoice may still belong in required accounting records. A live complaint may need a limited set of correspondence and transaction details. Those possibilities don't justify retaining an attendee's marketing profile or every registration answer indefinitely.

The ICO's storage limitation guidance says personal data should not be kept longer than needed. GDPR doesn't supply one universal retention period. Your business needs a reasoned schedule, with reviews and deletion or anonymisation when information is no longer necessary.

Use clear decision notes. "Keep for compliance" is too vague to help the attendee or the colleague checking your work. Name the specific obligation or claim, the information needed, who can access it and the retention endpoint or review date. If you can't explain those details, investigate before making the decision.

For example, GOV.UK's limited company recordkeeping guidance says relevant accounting records must generally be kept for six years from the end of the company financial year they relate to, sometimes longer. That is a UK limited company example. It isn't a six-year rule for every attendee record in every country.

Ask your accountant which transaction fields the applicable rules require. You may need the invoice and payment evidence without retaining the person's workshop interests, access preferences or promotional engagement history alongside them. Separate the records operationally so a finance reason doesn't become permission for more marketing.

Don't invent a dispute to justify retention. If there is a genuine complaint, chargeback or legal claim, keep what is necessary for that matter and review it when the reason ends. If you're unsure about a significant exception, get advice from the person qualified to make that decision.

Handle tickets, refunds and upcoming attendance carefully

An attendee might request deletion while they still hold a ticket. Don't assume that they want to cancel their attendance, surrender a refund or close a complaint. Ask about the practical outcome if it is unclear, while continuing work that doesn't depend on the answer.

Say someone bought a ticket to next month's conference and asks you to remove their profile. You need to understand whether they want marketing stopped, an optional directory entry removed or the whole booking relationship ended. Explain any information still necessary to deliver the booking and assess the applicable erasure rules for it.

Avoid using "contract" as a blanket exemption. The fact that a contract exists doesn't mean every field you collected is necessary. You may need a way to identify the ticket and communicate an important venue change. You probably don't need a promotional preference survey answer to admit the person.

If the attendee wants to cancel, handle the booking under your event refund policy and the law that applies. Keep the privacy decision separate from the commercial outcome. You shouldn't require someone to withdraw their deletion request as the price of receiving a refund they're entitled to.

Check unfinished transactions before removing references the finance team needs. That means locating the refund, assigning an owner and agreeing how necessary records will be retained. It doesn't mean delaying the deletion of unrelated optional information until every accounting task in the business is finished.

If you retain a contact channel for essential booking communication, keep it out of promotional sends. A venue change and an offer for your next festival have different purposes. Make sure the people writing emails understand that difference before they add a discount banner to an operational update.

Your event confirmation email should already make the booking, support contact and ticket access clear. When a deletion request affects those arrangements, explain the change to the attendee. Don't leave them guessing whether a missing account means their paid ticket has disappeared.

After the event or refund is complete, review the remaining information again. A reason that was valid while you delivered the booking may end afterwards. Put that review on the task rather than relying on somebody remembering it between two event launches.

Stop marketing and prevent accidental re-entry

A deletion request can arrive alongside an objection to direct marketing. Deal with that objection promptly. Don't leave the attendee in tomorrow's promotional campaign while you debate whether an invoice needs to remain in your accounts.

The ICO's guidance on respecting marketing preferences explains that people have an absolute right to object to direct marketing. It recommends keeping a suppression list, or do-not-contact list, so a later import doesn't start marketing again. Keep only the information necessary for that purpose and explain it when relevant.

This is where deletion can get counterintuitive. If you remove every trace of an email address, a colleague could import an old buyer list next week and treat that address as new. A minimal suppression record helps you respect the person's choice across future list changes.

Don't turn suppression into another customer profile. The purpose is to block unwanted marketing. It doesn't justify preserving their purchase preferences, campaign history or notes about why they complained. Limit access and make sure the record cannot become a sendable audience itself.

Check campaigns already queued and any automation that could trigger from a future event, list import or old registration record. Verify the behaviour in the tools you use. Removing a person from one visible list may leave them in a separate audience or a scheduled export.

Loopyah's attendee email tools distinguish event updates from promotions and automatically exclude opt-outs from promotional sends, according to the live product page. That helps with sending permissions. It doesn't prove a deletion request has been completed across finance records, contractor files or another company's systems.

If you imported contacts elsewhere or uploaded a customer audience to an advertising service, include those locations in your assessment. Follow the service's supported removal process, record the action and check whether a recurring sync could restore the entry. An old CSV can undo good work even when the main platform behaves correctly.

Test your import process with a safe internal example before the next launch. Confirm that a suppressed contact stays excluded when a historical list is uploaded. Use an address your team controls, not the requesting attendee's address. You want evidence that the safeguard works without sending another unwanted message.

Ask suppliers to act, then follow up

A deletion request doesn't end at your login screen. Where an erasure is required, consider the organisations and people who received that information. Include the ticketing service, email provider, event app, badge printer, check-in contractor and any relevant recipient identified in your search.

The European Data Protection Board's small business guide explains that a controller must respond to rights requests and a processor must assist. A controller decides why and how information is used; a processor handles it on the controller's behalf. Check the actual role and agreement for the processing concerned.

A supplier isn't automatically a processor for everything it does. A payment provider or another organisation may control some processing for its own obligations. Work out who is responsible for each part instead of promising that your instruction overrides every recipient's lawful retention duties.

Send a precise request through the approved channel. Identify the relevant person securely, describe the information and processing concerned and ask the supplier to confirm the action. Don't email a full attendee export to remove one record. Send only what the recipient needs to locate the right information.

Here is wording for a supplier acting on your behalf:

"Please action the erasure instruction for [secure reference] concerning [data and purpose] in the systems you operate for us. Confirm the live records removed, any linked copies addressed, the position on backups and any issue preventing completion. Please respond by [internal target], so we can meet our response deadline."

Adapt that wording to the contract and the recipient's role. If another controller has a separate responsibility, notify them appropriately and explain the status to the attendee without claiming an outcome you cannot verify. Keep a record of what you sent, when and through which channel.

Under the ICO's erasure guidance, recipients must generally be informed of erasure unless this is impossible or involves disproportionate effort. If the individual asks, tell them about the recipients. Where you made information public, assess the reasonable steps required for copies and links as well.

Chase unanswered requests early. A sent email proves that you contacted the supplier; it doesn't prove they removed the information. Track the reply and escalate a missing confirmation through the appropriate contact. Your final response needs to describe the position honestly, including any unresolved action.

Deal with backups, exports and paper copies

Backups are often the part everyone hopes nobody asks about. Ask anyway. You need to know whether deleted information remains in a backup, how long it stays there and what stops it from returning to normal use after a restore.

The ICO describes putting backup information beyond use when immediate overwriting isn't possible. That means it must not be used for another purpose while it awaits replacement under an established schedule. Be clear with the attendee about what happens. "Deleted everywhere" is inaccurate if you know recoverable copies remain.

Ask the system owner to explain the restore process in ordinary words. If a backup is restored after a failure, how will the team reapply the deletion before the information becomes available for everyday work? A written plan is useful only if the people recovering the system can actually follow it.

Exports deserve the same attention. Remove the applicable rows or files from shared drives, downloaded check-in sheets and badge lists. Ask contractors about their copies. Check email attachments where relevant, and prevent an old file from being reused as the starting point for your next event.

Paper records need an owner too. A printed door list left in a venue office can contain names, ticket categories and contact details. Arrange secure disposal where the information should be erased. Don't simply move it from the event kit into a storage cupboard and tick the task complete.

Be careful with analytics. Removing someone's name doesn't necessarily make a detailed record anonymous if an identifier or other information can still reconnect it to them. Assess whether the remaining information can identify the person, directly or indirectly. Don't relabel a customer reference as "anonymous" and stop there.

You may be able to retain genuinely anonymous totals for event reporting, such as overall ticket sales. Assess that separately from identifiable attendee histories. Small groups or unusual combinations can make a supposedly anonymous record easier to link to a person than the team expects.

Write the backup outcome in your request log and final response. Name the actual schedule or criteria your supplier has confirmed. Avoid choosing a convenient period just because it sounds reasonable. The important thing is that your explanation matches the system and the controls that keep the information out of use.

Verify the result before you tell the attendee

Now check the work from the attendee's point of view. If they asked to leave your promotional audience, can they still receive a triggered offer? If you removed their public directory entry, does it still appear on another event page? If you deleted the door export, did the contractor remove their downloaded copy?

Separate completed actions from instructions still waiting for confirmation. Mark retained records with their reason and review date. List backup treatment separately. One green "done" label can hide several different outcomes, and those differences matter when you write to the attendee.

Check recurring processes last. A data sync, template file or scheduled campaign can restore information after your search comes back empty. Ask who owns those processes and how they will respect the deletion or suppression decision. Otherwise your clean result may last only until the next import runs.

Keep a limited record of the request and your response for a justified accountability purpose. Decide what that record needs to contain and how long you will keep it. A request log shouldn't preserve a duplicate of the attendee's entire old profile under the label "proof".

Send a clear outcome, including any retained records

The final response should answer the person's question. What did you remove? What remains, why and for how long? What happened with recipients and backups? Keep it readable enough that the attendee doesn't need to translate your internal task notes.

Use specific categories where they help. "We've removed your optional registration answers and promotional profile" says more than "Your request has been processed". If you retain transaction records, explain the relevant obligation and restriction. Don't imply that those records can still be used to sell the next event.

Here is a completion template:

"We've completed our review of your deletion request. We removed [information] from [relevant live systems] on [date]. We [notified or received confirmation from] [relevant recipients]. We retain [limited records] because [specific reason], until [date or review criteria]. Access is limited to [purpose or team]."

Then add the parts that apply:

"Your information in backups is [actual position]. It is excluded from normal use and will be removed under [confirmed schedule]. We keep [minimal suppression information] to prevent future promotional contact. You won't receive promotional messages covered by your objection."

If you refuse any part of the erasure request, explain the reason and the person's right to complain to the relevant supervisory authority and seek a judicial remedy. Make the route clear. A partial refusal shouldn't obscure the information you've deleted or the actions you've taken on marketing preferences.

Also give the attendee your privacy complaints contact. The ICO's current complaints guidance requires organisations to provide a complaints process, acknowledge complaints within thirty days, investigate appropriately and communicate the outcome. That complaints acknowledgement period is separate from the erasure response deadline. Explain your own route alongside their regulator and court rights, without making an internal complaint a condition of exercising those rights.

Don't use the template as an excuse to send inaccurate boilerplate. Replace every bracket, remove irrelevant sentences and check the wording against the task log. If a supplier hasn't confirmed completion, say what you have done and what remains outstanding. Never describe an instruction as a verified deletion.

Make the next request easier to handle

Keep the owner and supplier contact details current so the next request reaches someone who can act immediately.

Once the request is closed, look at what took time. Was the supplier contact unclear? Did the team have three unofficial exports? Could nobody explain the backup schedule? Fix the specific failure while it is fresh, rather than adding a longer privacy document nobody uses.

Build deletion and retention into your event closeout. Optional operational details shouldn't sit around until someone complains. Decide which records expire after delivery, which need a longer justified period and who checks that the scheduled action happened. Reduce unnecessary collection at the next registration form as well.

The practical answer is to follow the information, make a decision for each purpose and verify the result. You can respect the attendee's request while keeping records you genuinely need. What matters is that you can explain the difference, carry it through every relevant system and stop old files from putting them back on your marketing list.